On May 9, Ascension, the largest nonprofit and Catholic health system in the United States, announced that it fell victim to a major cyber attack.
The attack on Ascension is different since it directly impacts clinical operations across multiple facilities.
After detecting suspicious activity on its network systems, Ascension quickly initiated remediation efforts and advised business associates to temporarily disconnect from its systems.
Ascension also engaged Google-owned cybersecurity firm Mandiant to assist with the investigation and remediation efforts.
The healthcare nonprofit notified all the appropriate authorities about the suspected cyber attack.
Let's dig into the details about what is known now about the Ascension cyber incident.
Ascension has 142 hospitals, 40 senior living facilities, and more than 2,600 care sites in 19 states and the District of Columbia.
While Ascension has not revealed how many of its facilities have been affected, there have been reports indicating care centers in multiple states are experiencing disruption.
CNN reported that four sources briefed on the investigation indicated that Ascension suffered a ransomware attack of the Black Basta variant.
The Detroit Free Press reported that Ascension employees noticed computer network problems around 7 a.m. on May 8, as per three workers who spoke on the condition of anonymity.
The Ascension attack directly influences patient care.
While it's still too early to know, the full impact of the Ascension cyber attack will be significant.
Ascension has relied on emergency backup procedures to manage patient care across the network's extensive system of hospitals and senior living facilities.
If the Change Healthcare incident is any indicator, regulatory bodies are certainly following the events of the Ascension breach closely.
On its event update page, Ascension states that they have notified the FBI, the Cybersecurity and Infrastructure Security Agency, the Department of Health and Human Services, and the American Hospital Association.
Only time will tell if a similar investigation will be opened against Ascension.
At least some components of Ascension, like its Neighborhood Resource program, are HIPAA-compliant and HITRUST-certified.
Ascension is part of an advisory council working with HITRUST and Frist Cressey Ventures to create best practices for data security for startups developing digital health technologies.
As the fallout from the Ascension cyber attack continues, the overall impact remains to be seen.
The back-to-back Change Healthcare and Ascension cyber incidents are shaking the healthcare industry to its core.
This Cyber News was published on securityboulevard.com. Publication date: Mon, 27 May 2024 17:13:07 +0000